Senior Cyber Operations Analyst

Accountabilities:: Serve as a subject matter expert for analysts supporting 24/7/365 security monitoring and incident response operations. Investigate, triage, and respond to cybersecurity incidents, including participation in off-hours and on-call rotations. Act as an escalation point for complex SOC investigations and day-to-day security operations while identifying opportunities for automation. Evaluate security operations capabilities, identify strengths and gaps, and recommend AI-enabled solutions that improve team performance and knowledge. Monitor emerging cybersecurity threats, vulnerabilities, AI developments, and adversary techniques that may affect the organization and its services. Automate repetitive security operations tasks within SOAR environments using cloud technologies, machine learning, and AI. Develop and enhance detection capabilities aligned with the MITRE ATT&CK framework, incorporating automation and AI where appropriate. Validate security alerts by interpreting confidence scores, risk ratings, recommended actions, and relevant threat intelligence. Use NLP and AI-powered tools to analyze security events, logs, incident data, and intelligence. Improve AI model performance and alert quality by labeling events and validating true and false positives. Use multi-agent collaboration and MCP-based solutions within security investigation and response workflows. Collaborate with data science and engineering teams to improve AI models and technologies used in SOC operations. Refine security playbooks, policies, procedures, and guidelines in line with industry best practices and evolving AI capabilities. Partner with security engineering, incident response, and IT teams to improve monitoring, detection, workflows, and response processes. Support the development and tracking of security metrics, KPIs, and service-level objectives. Participate in tabletop exercises and review findings from exercises, vulnerability assessments, and penetration tests to identify and address security gaps. Evaluate logging coverage and examine data across endpoints, databases, applications, identity systems, networks, mobile platforms, and cloud environments. Recommend security-tool adjustments to improve detection quality and reduce false positives. Provide guidance on monitoring, logging, identity, data protection, detection strategies, and preventive controls. Report on SOC performance, security posture, trends, and improvement opportunities to cybersecurity leaders and stakeholders. Mentor junior analysts and contribute to strengthening the overall capabilities and resilience of the security operations team. Requirements Bachelor’s degree and at least 6 years of related experience; equivalent additional directly related experience may be considered in lieu of a degree. Professional experience in SOC monitoring, cybersecurity operations, incident response, or a related field. Strong working knowledge of machine learning and AI and their practical application within security operations. Experience using NLP, query construction, and AI-powered tools to analyze logs, threat intelligence, and incident data. Experience with MCP servers, purpose-built agents, and AI assistants or platforms supporting security investigation and response. Demonstrated understanding of emerging cybersecurity threats, including adversaries’ use of AI-enabled attack techniques. Experience developing security detections aligned with the MITRE ATT&CK framework and relevant open-source AI frameworks. Proficiency with scripting languages such as Python, Bash, JavaScript, or PowerShell, along with experience using KQL. Hands-on experience with SOAR, SIEM, threat intelligence platforms, identity systems, sandboxes, vulnerability management, and EDR/XDR technologies. Strong understanding of cybersecurity threats, vulnerabilities, incident response principles, and security monitoring practices. Familiarity with security frameworks or regulations such as CMMC, NIST CSF, CIS, GDPR, or CCPA. Experience with Azure, AWS, and GCP; experience with government cloud environments is a plus. Experience managing or collaborating with Managed Security Service Providers (MSSPs). Strong analytical and problem-solving abilities, with the judgment to make timely decisions during complex and time-sensitive incidents. Excellent written and verbal communication skills, including the ability to explain cybersecurity incidents clearly and document post-incident reviews and root cause analyses. Strong organizational and time-management skills, with the ability to manage multiple priorities and deadlines in a fast-paced environment. Ability to combine strategic and tactical thinking to improve security operations and drive continuous improvement. Ability to remain calm and focused under pressure while handling urgent security priorities. Strong collaboration and stakeholder-management skills across technical and organizational levels. Preferred certifications include GIAC credentials such as GCED, GCIH, or GDAT, or Microsoft Security Operations Analyst Associate. Preferred experience includes managing SIEM, threat intelligence, security orchestration and automation, IDS/IPS, file integrity monitoring, data loss prevention, and network/system monitoring technologies. Experience conducting investigations using formal chain-of-custody procedures, forensic tools, and established forensic best practices is preferred. Domestic and/or international travel may be required based on workload and project demands; however, the source posting specifies no travel is required for this position. Visa sponsorship is not available for this position. Benefits Salary: USD $102,170–$178,776, with compensation determined by factors including geographic location, role responsibilities, relevant experience, skills, certifications, and education/training. Work arrangement: Fully remote or hybrid work options may be considered. Career growth: Opportunity to operate in a senior cybersecurity role with significant exposure to advanced security operations and emerging technologies. AI and automation exposure: Hands-on opportunities to apply AI, machine learning, NLP, MCP-based agents, and automation to real-world security operations. Technical scope: Work across SIEM, SOAR, EDR/XDR, cloud infrastructure, identity, networks, applications, endpoints, threat intelligence, and security analytics. Leadership opportunities: Serve as a senior escalation point, subject matter expert, and mentor to other security analysts. Cross-functional collaboration: Partner with engineering, data science, security, incident response, and IT teams. Continuous learning: Opportunity to stay current with emerging threats, AI-enabled attacks, evolving security technologies, and industry practices. Meaningful impact: Direct contribution to strengthening security posture, improving detection and response, and building more resilient security operations. Additional compensation: Discretionary bonuses may apply to the position.